QEMU implemented the configuration VIRTIO_BALLOON_F_REPORTING && ! VIRTIO_BALLOON_F_FREE_PAGE_HINT incorrectly: it then uses vq3 for reporting, spec says it is always 4. This is masked by a corresponding bug in driver: add a work around as I'm going to try and fix the driver bug. Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx> --- drivers/virtio/virtio_balloon.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index 9a61febbd2f7..7dc3fcd56238 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -597,8 +597,23 @@ static int init_vqs(struct virtio_balloon *vb) err = virtio_find_vqs(vb->vdev, VIRTIO_BALLOON_VQ_MAX, vqs, callbacks, names, NULL); - if (err) - return err; + if (err) { + /* + * Try to work around QEMU bug which since 2020 confused vq numbers + * when VIRTIO_BALLOON_F_REPORTING but not + * VIRTIO_BALLOON_F_FREE_PAGE_HINT are offered. + */ + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING) && + !virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) { + names[VIRTIO_BALLOON_VQ_FREE_PAGE] = "reporting_vq"; + callbacks[VIRTIO_BALLOON_VQ_FREE_PAGE] = balloon_ack; + err = virtio_find_vqs(vb->vdev, + VIRTIO_BALLOON_VQ_REPORTING, vqs, callbacks, names, NULL); + } + + if (err) + return err; + } vb->inflate_vq = vqs[VIRTIO_BALLOON_VQ_INFLATE]; vb->deflate_vq = vqs[VIRTIO_BALLOON_VQ_DEFLATE]; -- MST